supabase-debugger

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt includes many examples that embed API keys, JWTs, DB passwords, and Authorization headers inline (curl -H "apikey: ...", psql connection strings, createClient(..., 'YOUR_ANON_KEY'), etc.), which would require the model to insert secret values verbatim into generated commands or code.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill includes instructions that touch system-level configuration (e.g., editing a Caddyfile under /etc/caddy, using docker-compose, and referencing TLS certs) which imply modifying system files and changing the machine state, although it does not explicitly instruct privilege escalation, bypassing security, or creating OS user accounts.